Automate Go module mirror uploads for dependency updates

## Enhancement

Go module mirror uploads are currently not automated in the PR workflow. When `go.mod`, `go.sum`, or the parser module files change, contributors may regenerate Bazel files, but uploading missing module zip files to the mirror still depends on a manual local step with GCS credentials.

This makes dependency updates harder to finish reliably:

- Missing mirror objects can be discovered only after later Bazel jobs try to fetch them.
- The upload step depends on a developer having the right local credentials.
- The process is not tied to the PR approval flow, so it is easy to forget.

Expected behavior:

- When a PR changes Go module files, GitHub Actions can run the mirror upload helper.
- The upload job should use a dedicated GCS service account secret.
- Execution should be controlled by GitHub Environment approval, so repository settings decide who can approve the upload.
- The job should only upload mirror objects and should not commit generated file changes.

Suggested labels: type/enhancement, component/build